Hosting your own signed DuckDB extensions on S3-compatible storage

DuckDB 2.0 can trust your own signing key. Sign an extension with OpenSSL, put it in a bucket, and install it without -unsigned. Until DuckDB 2.0, hosting your own extension came with a catch. DuckDB only trusted its own keys: one set for core extensions and one for community extensions. If your extension couldn’t go through the community repository, which requires public source code, every client had to start with -unsigned. That switches off signature checks for every extension, not just yours. Version 2.0 adds a third option: custom extension repositories. A repository is a name, a URL prefix and one or more RSA public keys. You sign with your own key, put the files anywhere DuckDB can read, and each client pins your public key once: SET allow_extension_repositories = 'allowed'; CREATE EXTENSION REPOSITORY my_repo WITH PREFIX 'https://extensions.example.com' USING PUBLIC KEY '-----BEGIN PUBLIC KEY----- ...'; INSTALL AND LOAD my_ext FROM my_repo; I wanted this for my own extensions…